Jl 

to the transmission of messaj ;es over a portion of the period and also related to the position of the 
portion in the period, to enable output data to be derived from the stored information; 

creating a second signature comprising a plurality of parameters related to the transmission 



of messages over a second period shorter than the first and more recent than the first ; 
Cm) updating the first signature bv a weighted averaging with the second signature; and 
(iv) deriving said anomalies bv providing said signatures as input to an anomaly detector . 

2. (once amended) A method as claimed inyclaim 1 wherein the first signature is created in 
one of a plurality of predetermined possible fomnats. 

3. (once amended) A method as claime^l in Claim 2 wherein the format of the first signature 
comprises the length of the signature. 

4. (once amended) A method arc claimed in Claim 1 wherein said at least one parameter 
represents the number of evept^made m the pprfion of the first time period as a proportion of the 
total number of events made in the wrote first time period. 



5. (once amended) A meth^as claimed in Claim 1 wherein said at least one parameter 
represents the number o^€vents 6f a predetermined type made in the whole first time period as 
a proportion of the total numbenof events of the same type made in the whole first time period. 



6. (once amended) A method as claimed in Claim 1 wherein the step of creating a signature 
further comprises the steps of: 

storing information aboui^ach of a number of events which occurred during the first time period; 



selecting attributes frjsmJbSfl^Tmation; 

and converting the attiimnes into the said first signature. 



Cancel claim 7 without prejudice. 
Amend claim 8 as follows: 
c^uj)^^ ^ (once amended) A method as claimed in Claim [7] j wherein [the anomg 




f} 0 ^ comprises] said step (iv)ofdei 
ajaetxraTnetwork 




Cancel claim 9 without prejudice. 

Amend claims 10 through 13, 18 and 21 and 22 as follows: 



10. (once amended) The method of Claim 1 wherein [the data deriving] said step (iv) of 
deriving anomalies is carried out using a predictive model, the method further comgii&iilg the 
steps of: 

monitoring the performance of the model; and 

automatically updating the model when the perfoj*rfance reaches a predetermined threshold. 

1 1 . (once amended) The method of Claim 1 wherein [the data deriving] said step (iv) of 
deriving anomalies is carried out using a predictive model, and wherein the model is implemented 
using at least one instantiated object created using an object oriented programming language and 
the method/further comprises the steps of: 

convening the object into a data structure; 
Coring the data structure; and 
recreating the object from the data structure. 
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12. (once amended) A computer system for detecting anomalies in the transmission or 
messages by an entity by storing information relating to the transmission of messages by [anjlhe 
entity over a given time period , said computer system comprising: / 

(i) an input arranged to receive information about each of a number of events wmch occurred 
during the time period; / 

(ii) a processor arranged to convert the information into a signature^comprising a plurality of 
parameters related to the transmission of messages over the time period wherein the parameters 
comprise at least one parameter related to the transmissionxSf messages over a portion of the 
period and also related to the position of the portion in / the period, to enable output data to be 
derived from the stored information and wherein ssad processor is further arranged to convert at 
least part of the information into a second signature, comprising a plurality of parameters related 
to the transmission of messages over a segond period, shorter than the first and more recent than 
the first; and also to update the first signature by a weighted averaging with the second signature; 
and / 

(iip an input arranged tg> provide said signatures to an anomaly detector to derive said 
anomalies . / 

13. (once amended) A method of deriving [output data] anomalies from information relating 
to the transmission of messages by an entity over time, comprising the steps of: 

(i) creating /first signature comprising a plurality of parameters related to the transmission of 
messages/over a predetermined first time period; 

(ii) creating a second signature comprising a plurality of parameters related to the transmission 
of messages over a second period shorter than the first and more recent than the first; 

(iii) updating the first signature by a weighted averaging with the second signature; 




and (iv) deriving said anomalies using the signatures 



(once amended) A meih/bd as claimed in Claim 13 wherein [the deriving step comprises 
the step of detecting anoma^ep in] said information relates to the transmission of messages in a 
telecommunications netvjdrk. 



(once amended) The method of Claim 13 wherein [the data deriving] said steo£i} 
deriving said anomalies is carried out using a predictive model^jifid^Iierein the model is 
implemented using at least one instantiated object^eSfed using an object oriented programming 
language and the method fu0hsrt56mprises the steps of; 
converting ths-etfject into a data structure; 
ttmng the data structure; and 
recreating the object from the data structure. 

22 . (once amended) A computer system for deriving [output data] anomalies from inform^tkJiT 
relating to the transmission of messages by an entity over time, the system copapllsing: 
an input arranged to receive information about the transmissioj^efmessages by the entity; 
a processor arranged to create a first signature comprising a plurality of parameters related to the 
transmission of messages over a predetepfrfmed first time period and to create a second signature 
comprising a plurality of parameters related to the transmission of messages over a second period 
shorter than the fij^Tmid more recent than the first; 

a proces^erfarranged to calculate a weighted averaging of the first and second signatures to form 
updated first signature; 

and a processor arranged to derive said [output data] anomalies using said signatures. 



